AWS EBS Encryption

Encrypting an Amazon Elastic Block Store (EBS) volume has several implications and effects on the data stored in the volume. Here are the key points to consider:

  1. Encryption of Data in Transit:

    • When you enable encryption for an EBS volume, all data moving between the volume and the instance is encrypted. This helps secure the data while it is being transferred.

  2. Encryption at Rest:

    • Encryption at rest ensures that the data stored on the EBS volume is encrypted. This includes both the data blocks and any snapshots created from the volume.

  3. KMS Key Usage:

    • EBS volume encryption uses AWS Key Management Service (KMS) keys. You can choose to use the default AWS managed key for EBS or specify a customer-managed key (CMK) in AWS KMS.

  4. Impact on Snapshots:

    • If you create a snapshot of an encrypted EBS volume, the snapshot is also encrypted. When you launch an instance from an encrypted snapshot, the resulting EBS volumes will be encrypted as well.

  5. Performance Considerations:

    • Encrypting and decrypting data does introduce some overhead. While modern hardware and AWS infrastructure minimize this impact, it's worth considering if you have performance-sensitive workloads.

  6. Changing Encryption Status:

    • Once an EBS volume is encrypted, you cannot change its encryption status. Similarly, you cannot modify the encryption status of an existing snapshot. If you want to change the encryption status, you need to create a new encrypted volume or snapshot.

  7. Sharing Encrypted Snapshots:

    • If you share an encrypted snapshot with another AWS account, they must have the necessary permissions to use the KMS key associated with the snapshot.

  8. Limitations on Snapshot Copying:

    • When copying an unencrypted snapshot, you can choose to encrypt the copy. However, when copying an encrypted snapshot, the copy will always be encrypted, and you cannot choose to create an unencrypted copy.

https://www.youtube.com/watch?v=0MltSofWHTs&list=PL6XT0grm_TfgtwtwUit305qS-HhDvb4du&index=35